ttsc 0.31.1 → 0.31.3

package/src/plugin/internal/source/computeCacheKey.ts

@@ -5,11 +5,11 @@ import path from "node:path";
 import { GoToolResolution } from "./GoToolResolution";
 import type { ITtscBuildContributor } from "./ITtscBuildContributor";
 import type { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import type { SourcePluginWorkspace } from "./SourcePluginWorkspace";
 import { hashPluginBuildEnvironment } from "./hashPluginBuildEnvironment";
 import { pluginModuleReplaceDirectories } from "./pluginModuleReplaceDirectories";
-import { pluginSourceDigest } from "./pluginSourceDigest";
 
 /**
  * Compute a 32-character lowercase key from a plugin build's SHA-256 digest.
@@ -30,10 +30,12 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * values are trusted producer readings, not revalidated content observations.
  * `sourceDigests` carries the digests one load already took: every build of the
  * load keys on one reading of each directory, and the load reports those
- * readings. The environment enters through `hashPluginBuildEnvironment`, the
- * rule that reported state takes it from too, and `environmentDigests` carries
- * the digest of each build directory's, so the load reports it without a second
- * `go env` run.
+ * readings. The environment enters as the digest of
+ * `hashPluginBuildEnvironment`, the rule that reported state takes it from too,
+ * and `environmentDigests` carries the digest of each build directory's, so the
+ * load reports it without a second `go env` run. With `environmentWitnesses`, a
+ * reading the load already took for the same directory, such as package
+ * selection's, keys the build too, and its witness joins the build's.
  *
  * The `ttsc cache` CLI and plugin build pipeline share this key computation.
  *
@@ -43,7 +45,7 @@ import { pluginSourceDigest } from "./pluginSourceDigest";
  * @evidence contracts/common.md#meaningful-documentation Native paragraphs explain input coverage and the provenance of reported digests; documented optional output maps have blank separation between members.
  * @evidence contracts/portability.md#os-neutral-implementation Native roots are resolved with Node path APIs and executable resolution; platform/architecture intentionally distinguish incompatible binary artifacts.
  * @evidence contracts/performance.md#efficient-algorithms Source digest misses enumerate/sort paths and read individual files in full, not bounded streaming chunks. Overlay/contributor ordering compares path/name text; replacement discovery can read a manifest/run Go and native containment queries. Toolchain/env hashing delegates native metadata/probes/full bytes and memo checks without an unmeasured dominant-cost ranking; JSON framing processes all version/entry/label/digest text.
- * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe; it does not skip environment hashing. Reuse inherits the selected population and metadata/producer premises.
+ * @evidence contracts/performance.md#reuse-equivalent-work Caller-owned sourceDigests share supplied absolute-directory readings across roles without independently verifying their provenance/currentness. A supplied record store lets a new process reuse a directory, SDK or executable digest only while its separable metadata signature matches the recorded one (#1722), so unchanged inputs are not re-read per process. EnvironmentDigests receives this call's selected environment identity so reporting can avoid another probe. A same-directory reading of the same load, with its witness, replaces a second environment probe; the witness then joins this build's, which the build compares after it ran, and a non-default byte adapter never shares. Reuse inherits the selected population and metadata/producer premises.
  *
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Output maps belong to the enclosing load; this operation retains no handles or process-wide records itself.
  */
@@ -66,6 +68,14 @@ export function computeCacheKey(inputs: {
    */
   environmentDigests?: Map<string, string>;
 
+  /**
+   * Witness of each reading in `environmentDigests` this load took, by
+   * directory. A digest with its witness stands for this call's own reading:
+   * the key takes it instead of running Go again and copies the witness into
+   * `environmentWitness`. Filled with this call's reading when it takes one.
+   */
+  environmentWitnesses?: Map<string, PluginBuildEnvironmentWitness.Record>;
+
   /**
    * Receives selected native toolchain dependencies from the environment reader
    * for later comparison under its metadata-distinguishability premise; it is
@@ -77,6 +87,14 @@ export function computeCacheKey(inputs: {
   filesystem?: Partial<SourceBuildFilesystemOperations>;
   goBinary?: string;
   goModReader?: SourcePluginWorkspace.GoModReader;
+
+  /**
+   * Record store that proves unchanged sources, overlays, contributors, GOROOT
+   * and executables from metadata in a new process (#1722). Without it every
+   * process reads their bytes.
+   */
+  identities?: PluginContentIdentities.Store;
+
   overlayDirs?: readonly string[];
 
   /**
@@ -128,61 +146,96 @@ export function computeCacheKey(inputs: {
   // binaries produced by the former absolute-ancestry layout out of this
   // layout's cache admissions, including callers with no SDK overlays.
   hash.update(JSON.stringify(["external-source-layout", 1]));
-  // The same framed values enter the key and the environment-only digest,
-  // which pluginBuildEnvironment reads for this directory.
-  const environment = crypto.createHash("sha256");
-  hashPluginBuildEnvironment(
-    {
-      update: (data: string) => {
-        hash.update(data);
-        environment.update(data);
-      },
-    },
-    goBinary,
-    inputs.dir,
-    env,
-    filesystem,
-    inputs.environmentWitness,
-  );
-  inputs.environmentDigests?.set(
-    path.resolve(inputs.dir),
-    environment.digest("hex"),
+  const overlays = [...(inputs.overlayDirs ?? [])].sort();
+  // Hash contributors in sorted-by-name order so two consumers with the
+  // same logical set produce the same key regardless of declaration order
+  // in the host's plugin descriptor.
+  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
+    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
   );
-  hashSourceDirectory(hash, "plugin", inputs.dir, inputs.sourceDigests);
+  // A store whose root lies inside a directory this key hashes would write
+  // records into that source, so such a store proves nothing here. The build
+  // rejects that cache placement (`SourcePluginAdmission`) once every source
+  // is known; replacement targets narrow the store below, before their own
+  // digests, since only Go's reading of the manifest names them.
+  let identities = PluginContentIdentities.outside(inputs.identities, [
+    inputs.dir,
+    ...overlays,
+    ...sortedContributors.map((contributor) => contributor.source),
+  ]);
+  // The key frames the environment digest pluginBuildEnvironment reports for
+  // this directory. WARNING (#1721): package selection reads that environment
+  // first in the same load; reading it again here doubled `go env` and
+  // `go version` per load. A reading taken through another byte adapter is
+  // not this one's, so only the default adapter shares it.
+  const environmentDirectory = path.resolve(inputs.dir);
+  const sharedDigest =
+    inputs.filesystem === undefined
+      ? inputs.environmentDigests?.get(environmentDirectory)
+      : undefined;
+  const sharedWitness =
+    sharedDigest === undefined
+      ? undefined
+      : inputs.environmentWitnesses?.get(environmentDirectory);
+  let environment: string;
+  if (sharedDigest !== undefined && sharedWitness !== undefined) {
+    // The build compares this witness after it ran, exactly as it would its
+    // own reading's, so a toolchain change since the reading still refuses.
+    for (const [file, state] of sharedWitness)
+      if (!inputs.environmentWitness?.has(file))
+        inputs.environmentWitness?.set(file, state);
+    environment = sharedDigest;
+  } else {
+    const witness =
+      inputs.environmentWitness ??
+      (inputs.environmentWitnesses === undefined ? undefined : new Map());
+    const reading = crypto.createHash("sha256");
+    hashPluginBuildEnvironment(
+      reading,
+      goBinary,
+      inputs.dir,
+      env,
+      filesystem,
+      witness,
+      identities,
+    );
+    environment = reading.digest("hex");
+    inputs.environmentDigests?.set(environmentDirectory, environment);
+    if (inputs.filesystem === undefined && witness !== undefined)
+      inputs.environmentWitnesses?.set(environmentDirectory, new Map(witness));
+  }
+  hash.update(JSON.stringify(["environment", environment]));
+  const directory = (label: string, root: string): void =>
+    hashSourceDirectory(hash, label, root, inputs.sourceDigests, identities);
+  directory("plugin", inputs.dir);
   // Local replacement targets outside the module supply separately keyed
   // sources. buildSourcePlugin snapshots and proves their copies before
-  // redirecting the Go replacement directives to the scratch tree.
-  for (const replacement of pluginModuleReplaceDirectories(
+  // redirecting the Go replacement directives to the scratch tree. Go reads the
+  // manifest after the plugin's digest, so an edit made meanwhile lands between
+  // that digest and the build's copy, which `requireKeyedSource` refuses.
+  const replacements = pluginModuleReplaceDirectories(
     inputs.dir,
     env,
     goBinary,
     inputs.goModReader,
-  )) {
-    hashSourceDirectory(
-      hash,
+  );
+  identities = PluginContentIdentities.outside(
+    identities,
+    replacements.map((replacement) => replacement.directory),
+  );
+  for (const replacement of replacements) {
+    directory(
       `replace:${replacement.modulePath}${
         replacement.version === undefined ? "" : `@${replacement.version}`
       }`,
       replacement.directory,
-      inputs.sourceDigests,
     );
   }
-  for (const [index, dir] of [...(inputs.overlayDirs ?? [])].sort().entries()) {
-    hashSourceDirectory(hash, `overlay:${index}`, dir, inputs.sourceDigests);
+  for (const [index, dir] of overlays.entries()) {
+    directory(`overlay:${index}`, dir);
   }
-  // Hash contributors in sorted-by-name order so two consumers with the
-  // same logical set produce the same key regardless of declaration order
-  // in the host's plugin descriptor.
-  const sortedContributors = [...(inputs.contributors ?? [])].sort((a, b) =>
-    a.name === b.name ? 0 : a.name < b.name ? -1 : 1,
-  );
   for (const contributor of sortedContributors) {
-    hashSourceDirectory(
-      hash,
-      `contributor:${contributor.name}`,
-      contributor.source,
-      inputs.sourceDigests,
-    );
+    directory(`contributor:${contributor.name}`, contributor.source);
   }
   return hash.digest("hex").slice(0, 32);
 }
@@ -197,11 +250,14 @@ function hashSourceDirectory(
   label: string,
   root: string,
   digests: Map<string, string> | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): void {
   const directory = path.resolve(root);
   let digest = digests?.get(directory);
   if (digest === undefined) {
-    digest = pluginSourceDigest(directory);
+    // WARNING (#1722): the load-scoped map above ends with the process. Only the
+    // record store spares a new process from reading every source byte again.
+    digest = PluginContentIdentities.sourceDirectory(identities, directory);
     digests?.set(directory, digest);
   }
   hash.update(JSON.stringify(["dir", label, digest]));

package/src/plugin/internal/source/hashPluginBuildEnvironment.ts

@@ -6,6 +6,7 @@ import { GoEnvironmentReading } from "./GoEnvironmentReading";
 import { GoSourceInputs } from "./GoSourceInputs";
 import { GoToolResolution } from "./GoToolResolution";
 import { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import { PluginContentIdentities } from "./PluginContentIdentities";
 import type { SourceBuildFilesystemOperations } from "./SourceBuildFilesystemOperations";
 import { spawnGoTool } from "./spawnGoTool";
 
@@ -42,14 +43,17 @@ import { spawnGoTool } from "./spawnGoTool";
  *   variable carries: the Go tool, the Go environment file `go env -w` writes,
  *   the executables the C toolchain commands name, and GOROOT. A consumer that
  *   keeps the reading compares their metadata before reusing it.
+ * @param identities Record store that lets a new process prove the GOROOT
+ *   corpus and executable bytes from their metadata (`PluginContentIdentities`,
+ *   #1722); without it every process reads them.
  * @evidence contracts/common.md#principled-implementation Fixed artifact flags, observed compiler bytes/version, selected reported-or-fallback build values, named command executables and selected SDK files enter the same framed identity used by source-state reporting. Fallback values and metadata-qualified reuse are explicit premises, not complete observation of arbitrary toolchain inputs.
  * @evidence contracts/common.md#clear-and-simple-design Private helpers separate compiler identity, Go-reported settings, external variables and SDK content while sharing one hash sink and optional pre-read witness.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts Cache signatures include real identity/change metadata and effective invocation context; failed SDK witnessing refuses reuse rather than accepting a VERSION-only proxy.
  * @evidence contracts/common.md#meaningful-documentation Native documentation names the input classes and witness purpose; private comments explain context-sensitive compiler memoization and SDK exclusions without treating a passing check as proof.
  * @evidence contracts/portability.md#os-neutral-implementation Node path/stat/process APIs resolve native tool identities; platform-specific executable suffixes and environment lookup are isolated in GoToolResolution, and Go supplies its own effective build settings.
  * @evidence contracts/performance.md#efficient-algorithms SDK traversal sorts reached entry names and selected file paths, performs native stat/realpath/link queries and serializes topology/metadata/path text. Matching manifests share aggregate hashes; changes read full selected files via the caller adapter, retaining file buffers with population/topology data. Compiler misses capture at most three complete version/byte readings when native metadata moves during a reading; only a stable attempt enters the memo. Go env can run up to three times for its file witness, and command tokens can each perform executable searches/full reads. Environment sorting/framing and command substring parsing also process name/value/command bytes; E/D/F/B alone do not capture native lookup or text comparison costs.
- * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. Both rely on native metadata distinguishability and sequential observation premises, not independently rehashed content on each hit. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
- * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
+ * @evidence contracts/performance.md#reuse-equivalent-work Compiler memo identity includes selected path/file metadata and invocation cwd/environment; SDK aggregate reuse requires matching complete ordered metadata/topology. With a record store, a new process reuses the SDK aggregate and executable digests only while their signatures match the recorded ones and every stamp is separable from a freshly minted reference (#1722); `go version` and `go env` stay live because they report toolchain selection no file metadata shows. All of this relies on native metadata distinguishability and sequential observation premises. Physical directories expand once per selection policy while aliases retain edges; optional caller witnesses receive reached selected dependencies.
+ * @evidence contracts/performance.md#bound-retention-and-release-resources Compiler, Go-environment-path and SDK maps retain historical distinct tool/context/root keys without eviction; persisted records belong to the single-file collector. SDK population/topology and full individual file reads contribute transient bytes; synchronous probes delegate process/capture lifetime to their owner and do not certify arbitrary descendants are gone. No independent entry/record/file/output byte ceiling is imposed here.
  */
 export function hashPluginBuildEnvironment(
   hash: { update(data: string): unknown },
@@ -58,6 +62,7 @@ export function hashPluginBuildEnvironment(
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): void {
   // Fixed artifact policy must invalidate binaries and reported source states
   // together, including binaries cached before this policy was introduced.
@@ -68,11 +73,25 @@ export function hashPluginBuildEnvironment(
     hash.update(
       JSON.stringify([
         "go",
-        resolveGoCompilerIdentity(goBinary, env, directory, witness),
+        resolveGoCompilerIdentity(
+          goBinary,
+          env,
+          directory,
+          witness,
+          identities,
+        ),
       ]),
     );
   }
-  hashGoBuildEnvironment(hash, goBinary, directory, env, filesystem, witness);
+  hashGoBuildEnvironment(
+    hash,
+    goBinary,
+    directory,
+    env,
+    filesystem,
+    witness,
+    identities,
+  );
   hashExternalGoBuildEnvironment(hash, env);
 }
 
@@ -173,6 +192,7 @@ function resolveGoCompilerIdentity(
   env: NodeJS.ProcessEnv = process.env,
   cwd: string = process.cwd(),
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): string {
   const selected = GoToolResolution.resolveGoToolForBuild(
     goBinary,
@@ -217,7 +237,13 @@ function resolveGoCompilerIdentity(
       compilerEnv,
       cwd,
     );
-    identity = computeGoCompilerIdentity(selected, resolved, compilerEnv, cwd);
+    identity = computeGoCompilerIdentity(
+      selected,
+      resolved,
+      compilerEnv,
+      cwd,
+      identities,
+    );
     if (!PluginBuildEnvironmentWitness.holds(observed)) continue;
     for (const [file, signature] of observed)
       if (witness !== undefined && !witness.has(file))
@@ -269,10 +295,13 @@ function computeGoCompilerIdentity(
   resolved: string,
   env: NodeJS.ProcessEnv,
   cwd: string,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   if (!fs.existsSync(resolved)) {
     return "missing";
   }
+  // `go version` stays a live probe: it answers which toolchain the effective
+  // environment selects (GOTOOLCHAIN, go.mod), which no file metadata shows.
   const version = spawnGoTool(goBinary, ["version"], {
     cwd,
     encoding: "utf8",
@@ -283,10 +312,27 @@ function computeGoCompilerIdentity(
     version.error !== undefined
       ? ((version.error as NodeJS.ErrnoException).code ?? version.error.message)
       : `${version.status ?? 0}:${version.stdout}${version.stderr}`;
-  const binaryHash = hashFile(resolved);
+  const binaryHash = hashExecutable(resolved, identities);
   return `sha256:${binaryHash}:${versionText}`;
 }
 
+/**
+ * The content digest of an executable, proven from its metadata in a process
+ * that has the record store (#1722) and read in full otherwise.
+ */
+function hashExecutable(
+  file: string,
+  identities: PluginContentIdentities.Store | undefined,
+): string {
+  return PluginContentIdentities.digest(
+    identities,
+    "executable",
+    file,
+    (references) => PluginContentIdentities.fileObservation(references, file),
+    () => hashFile(file),
+  );
+}
+
 function resolveExecutableIdentityPath(
   binary: string,
   env: NodeJS.ProcessEnv = process.env,
@@ -352,7 +398,8 @@ function hashGoBuildEnvironment(
   cwd: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): void {
   const values = resolveGoBuildEnvironment(
     goBinary,
@@ -360,6 +407,7 @@ function hashGoBuildEnvironment(
     env,
     filesystem,
     witness,
+    identities,
   );
   for (const key of GO_BUILD_ENV_KEYS) {
     const value = values.get(key);
@@ -374,7 +422,8 @@ function resolveGoBuildEnvironment(
   cwd: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): Map<string, string> {
   const values = new Map<string, string>();
   if (goBinary !== undefined) {
@@ -384,6 +433,7 @@ function resolveGoBuildEnvironment(
       env,
       GO_BUILD_ENV_KEYS,
       witness,
+      identities,
     );
     if (parsed !== undefined) {
       try {
@@ -392,7 +442,14 @@ function resolveGoBuildEnvironment(
           if (typeof raw === "string" && raw !== "") {
             values.set(
               key,
-              normalizeGoBuildEnvValue(key, raw, env, filesystem, witness),
+              normalizeGoBuildEnvValue(
+                key,
+                raw,
+                env,
+                filesystem,
+                witness,
+                identities,
+              ),
             );
           }
         }
@@ -408,7 +465,14 @@ function resolveGoBuildEnvironment(
     if (value !== undefined && value !== "") {
       values.set(
         key,
-        normalizeGoBuildEnvValue(key, value, env, filesystem, witness),
+        normalizeGoBuildEnvValue(
+          key,
+          value,
+          env,
+          filesystem,
+          witness,
+          identities,
+        ),
       );
     }
   }
@@ -420,7 +484,8 @@ function normalizeGoBuildEnvValue(
   value: string,
   env: NodeJS.ProcessEnv,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   if (key === "GOROOT") {
     // Root/version observations also cover a missing SDK. The complete SDK
@@ -428,10 +493,15 @@ function normalizeGoBuildEnvValue(
     // nested content changes that do not move the root or VERSION metadata.
     PluginBuildEnvironmentWitness.add(witness, value);
     PluginBuildEnvironmentWitness.add(witness, path.join(value, "VERSION"));
-    return resolveGoRootCacheIdentity(value, filesystem, witness);
+    return resolveGoRootCacheIdentity(value, filesystem, witness, identities);
   }
   if (GO_BUILD_COMMAND_ENV_KEYS.has(key)) {
-    return `${value}\0${resolveCommandCacheIdentity(value, env, witness)}`;
+    return `${value}\0${resolveCommandCacheIdentity(
+      value,
+      env,
+      witness,
+      identities,
+    )}`;
   }
   return value;
 }
@@ -451,7 +521,8 @@ function normalizeGoBuildEnvValue(
 function resolveCommandCacheIdentity(
   command: string,
   env: NodeJS.ProcessEnv,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   const tokens = splitGoCommand(command);
   if (tokens === null) {
@@ -473,7 +544,7 @@ function resolveCommandCacheIdentity(
   }
   let identity: string;
   try {
-    identity = `command:sha256:${hashFile(resolved)}`;
+    identity = `command:sha256:${hashExecutable(resolved, identities)}`;
   } catch {
     return `command:unreadable:${resolved}`;
   }
@@ -487,7 +558,7 @@ function resolveCommandCacheIdentity(
     if (!GoToolResolution.isExecutableFile(operand)) return;
     PluginBuildEnvironmentWitness.add(witness, operand);
     try {
-      identity += `;${index + 1}:sha256:${hashFile(operand)}`;
+      identity += `;${index + 1}:sha256:${hashExecutable(operand, identities)}`;
     } catch {
       identity += `;${index + 1}:unreadable:${operand}`;
     }
@@ -544,6 +615,9 @@ interface GoRootIdentitySnapshot {
   files: string[];
   topology: string[];
   signature: string;
+
+  /** Whether every file stamp precedes its device's minted reference. */
+  separable: boolean;
 }
 
 interface GoRootIdentityCacheEntry {
@@ -554,19 +628,31 @@ interface GoRootIdentityCacheEntry {
 // GOROOT is usually stable but its selected source/tool payloads contribute to
 // every plugin key. Retain only the final aggregate
 // identity, guarded by a fresh metadata/topology manifest on every call. A
-// changed or incomplete manifest falls through to a full content read.
+// changed or incomplete manifest falls through to the record store, then to a
+// full content read.
+//
+// WARNING (#1186, #1722): this map lives only as long as the process. #1186
+// stopped at it, so every CLI launch, worker and bundler restart still read the
+// whole SDK (3,723 files, 135 MB for the bundled toolchain). The record store
+// below is what carries the identity across processes; never drop it in favor
+// of this memo alone.
 const goRootIdentityCache = new Map<string, GoRootIdentityCacheEntry>();
 
 function resolveGoRootCacheIdentity(
   goRoot: string,
   filesystem: SourceBuildFilesystemOperations,
-  witness?: PluginBuildEnvironmentWitness.Record,
+  witness: PluginBuildEnvironmentWitness.Record | undefined,
+  identities: PluginContentIdentities.Store | undefined,
 ): string {
   const resolved = resolveRealPath(goRoot);
   if (!fs.existsSync(resolved)) {
     return `missing:${goRoot}`;
   }
-  const snapshot = collectGoRootIdentitySnapshot(resolved, witness);
+  const snapshot = collectGoRootIdentitySnapshot(
+    resolved,
+    witness,
+    identities?.references,
+  );
   if (!snapshot.complete)
     PluginBuildEnvironmentWitness.refuse(witness, resolved);
   if (snapshot.complete) {
@@ -575,15 +661,37 @@ function resolveGoRootCacheIdentity(
       return cached.identity;
     }
   }
-  const hash = crypto.createHash("sha256");
-  hash.update(JSON.stringify(snapshot.topology));
-  for (const file of snapshot.files) {
-    const relative = path.relative(resolved, file).split(path.sep).join("/");
-    const contents = filesystem.readFile(file);
-    hash.update(JSON.stringify([relative, contents.length]));
-    hash.update(contents);
-  }
-  const identity = `sha256:${hash.digest("hex")}`;
+  // The first observation is the snapshot the witness just recorded; a second
+  // one, after the content read, brackets that read for publication.
+  let observed = 0;
+  const identity = PluginContentIdentities.digest(
+    snapshot.complete ? identities : undefined,
+    "goroot",
+    resolved,
+    (references) => {
+      const current =
+        observed++ === 0
+          ? snapshot
+          : collectGoRootIdentitySnapshot(resolved, undefined, references);
+      return current.complete
+        ? { separable: current.separable, signature: current.signature }
+        : undefined;
+    },
+    () => {
+      const hash = crypto.createHash("sha256");
+      hash.update(JSON.stringify(snapshot.topology));
+      for (const file of snapshot.files) {
+        const relative = path
+          .relative(resolved, file)
+          .split(path.sep)
+          .join("/");
+        const contents = filesystem.readFile(file);
+        hash.update(JSON.stringify([relative, contents.length]));
+        hash.update(contents);
+      }
+      return `sha256:${hash.digest("hex")}`;
+    },
+  );
   if (snapshot.complete) {
     goRootIdentityCache.set(resolved, {
       identity,
@@ -596,9 +704,10 @@ function resolveGoRootCacheIdentity(
 function collectGoRootIdentitySnapshot(
   root: string,
   witness?: PluginBuildEnvironmentWitness.Record,
+  references?: ReadonlyMap<bigint, bigint>,
 ): GoRootIdentitySnapshot {
   const out: string[] = [];
-  const state = { complete: true };
+  const state = { complete: true, separable: references !== undefined };
   const topology: string[] = [];
   walkGoRootIdentity(root, out, topology, state, witness);
   out.sort();
@@ -613,6 +722,11 @@ function collectGoRootIdentitySnapshot(
         state.complete = false;
         continue;
       }
+      if (
+        references === undefined ||
+        !PluginContentIdentities.separable(references, stats)
+      )
+        state.separable = false;
       signature.update(
         [
           relative,
@@ -634,6 +748,7 @@ function collectGoRootIdentitySnapshot(
     files: out,
     topology,
     signature: signature.digest("hex"),
+    separable: state.separable,
   };
 }
 

package/src/plugin/internal/source/pluginBuildEnvironment.ts

@@ -3,6 +3,7 @@ import fs from "node:fs";
 
 import { GoToolResolution } from "./GoToolResolution";
 import type { PluginBuildEnvironmentWitness } from "./PluginBuildEnvironmentWitness";
+import type { PluginContentIdentities } from "./PluginContentIdentities";
 import { hashPluginBuildEnvironment } from "./hashPluginBuildEnvironment";
 import { resolveGoCompiler } from "./resolveGoCompiler";
 
@@ -19,12 +20,16 @@ import { resolveGoCompiler } from "./resolveGoCompiler";
  * GOROOT metadata. Witnessing a newly selected environment file can repeat the
  * probe to observe it before reading. Compiler identity reuses a
  * metadata-and-context memo; a changed SDK manifest rehashes all contributing
- * content rather than only edited files.
+ * content rather than only edited files. A supplied record store lets a new
+ * process take the SDK and executable digests from records instead of their
+ * bytes, while `go env` and `go version` still run.
  *
  * @param directory The directory a build runs `go` in.
  * @param env The effective environment, `process.env` by default.
  * @param witness Receives the paths the reading depends on and no variable
  *   carries (`hashPluginBuildEnvironment`).
+ * @param identities Record store that lets a new process prove the SDK and
+ *   executables from metadata (#1722).
  * @evidence contracts/common.md#principled-implementation The digest uses the same resolved compiler and environment serializer as the binary key, so reported toolchain state denotes the inputs actually used by the build.
  * @evidence contracts/common.md#clear-and-simple-design Compiler selection, executable resolution and hashing each stay with their owning helper; this function only composes one environment reading.
  * @evidence contracts/common.md#prohibited-implementation-shortcuts The result comes from real Go/environment inputs, not a fixed compiler version or a caller-specific substitute.
@@ -32,13 +37,14 @@ import { resolveGoCompiler } from "./resolveGoCompiler";
  * @evidence contracts/portability.md#os-neutral-implementation Executable identity is resolved before probing, and Node filesystem/process boundaries implement native spelling rather than assuming Windows or POSIX paths are interchangeable.
  * @evidence contracts/performance.md#efficient-algorithms The wrapper resolves the compiler/tool under the supplied environment before delegating full environment hashing. Native resolution/probes, SDK metadata/name/path sorting and changed-manifest full content reads contribute cost; the final hash output is fixed-width but streamed identity/input text and full-file buffers are not. No independent duplicate source-directory digest scan is added here.
  *
- * @evidenceExclude contracts/performance.md#reuse-equivalent-work This is the fresh-reading boundary required by builds; processPluginBuildEnvironment owns reuse when a consumer permits it.
+ * @evidence contracts/performance.md#reuse-equivalent-work This is the fresh-reading boundary required by builds: the Go probes run on every call. Content digests of the SDK and executables are shared across processes only through the supplied record store's separable-signature proof; processPluginBuildEnvironment owns reuse of the whole reading when a consumer permits it.
  * @evidenceExclude contracts/performance.md#bound-retention-and-release-resources Its digest and filesystem adapter are call-local; retained compiler/content memo ownership belongs to the hasher.
  */
 export function pluginBuildEnvironment(
   directory: string,
   env: NodeJS.ProcessEnv = process.env,
   witness?: PluginBuildEnvironmentWitness.Record,
+  identities?: PluginContentIdentities.Store,
 ): string {
   const goBinary = GoToolResolution.resolveGoToolForBuild(
     resolveGoCompiler(env).binary,
@@ -54,6 +60,7 @@ export function pluginBuildEnvironment(
     env,
     { readFile: (location) => fs.readFileSync(location) },
     witness,
+    identities,
   );
   return hash.digest("hex");
 }